Threats tagged 'ghsa-p57v-42f3-wfqr'

A stored Cross-Site Scripting (XSS) vulnerability exists in the Simple Shopping Cart WordPress plugin before version 5.2.6. This vulnerability arises because some settings field values are not properly escaped before being output on an admin settings page. It allows high-privilege users, such as administrators, to inject malicious scripts. The issue is particularly impactful on multisite WordPress installations where administrators lack the unfiltered_html capability.